skyexpresscourierservice[.]net

Analysis of the domain skyexpresscourierservice.net indicates it is actively serving a high-risk phishing page targeting courier or logistics services. The domain was registered on November 8, 2025, through Fewmoretaps OU operating under Trustname.com. Infrastructure analysis reveals it resolves to the IP address 188.114.97.3, and the page title explicitly presents itself as 'Sky Express Courier,' suggesting an attempt to impersonate a legitimate delivery or shipping service. The domain appears on two security blocklists and is flagged in 22 threat intelligence pulses on AlienVault OTX, reinforcing its malicious classification. Detection engines on VirusTotal report five security vendors identifying the domain as malicious out of 95 scanned, though this does not constitute exhaustive validation. Technologies detected on the domain include WordPress, MySQL, PHP, Bootstrap, Swiper, Slick, jQuery UI, and jQuery Migrate, which may indicate a templated or kit-based phishing framework. The SSL certificate is issued by Google Trust Services, which does not mitigate the inherent risk of the domain's content. The domain remains active as of July 12, 2026, and is currently blocked by at least two security mechanisms, including PhishDestroy and BLP-Malware. Defenders should treat this domain as an active phishing threat, particularly in environments where courier or logistics-themed communications are common. The exact content and targeting mechanisms of the phishing page are not yet analyzed, but the domain's infrastructure and detection history warrant immediate blocking and monitoring for related indicators of compromise.